I think MBR is messed up. Won't boot, access denied

How to use TestDisk to recover lost partition
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
varmint
Posts: 5
Joined: 01 Nov 2012, 23:04

I think MBR is messed up. Won't boot, access denied

#1 Post by varmint »

I was hoping for a little help with your program if you hafve a minute.


thanks V


I don't know what I'm doing. I ran Rougekille some time ago and it found some things and then it also said there was a problem with the MBR that should be fixed. I let it fix it and sine then I have not been able to boot the drive or look at the C or 1st partition. I have looked through your documentation but I'm not sure what to do. I let it read write , repair mbr and still its the same. Oh an I was referred to your program by author of Rougekiller tgziyy I think is his handle.

the drive is a seagate Barracuda 7200.9 model ST31060812A 160G

If you could tell me how to use your program I'd appreciate it. Or I guess too if by looking at my log file tell me if its wrecked. I know some things but just enough to be dangerous I guess . LOL

thank you

V




Thu Nov 1 15:59:09 2012
Command line: TestDisk

TestDisk 6.14-WIP, Data Recovery Utility, September 2012
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org
OS: Windows XP SP2
Compiler: GCC 4.6, Cygwin 1007.9
Compilation date: 2012-09-30T10:59:38
ext2fs lib: 1.42.2, ntfs lib: 10:0:0, reiserfs lib: 0.3.1-rc8, ewf lib: 20120504
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sda)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(/dev/sdb)=160040803840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive0)=120034123776
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\PhysicalDrive1)=160040803840
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\C:)=120023253504
filewin32_getfilesize(\\.\D:) GetFileSize err Incorrect function.

filewin32_setfilepointer(\\.\D:) SetFilePointer err Incorrect function.

Warning: can't get size for \\.\D:
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\F:)=136317533184
disk_get_size_win32 IOCTL_DISK_GET_LENGTH_INFO(\\.\G:)=23713449984
Hard disk list
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512 - ST9120823AS, FW:3.AAB
Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63, sector size=512 - ST316081 2A

Partition table type (auto): Intel
Disk /dev/sdb - 160 GB / 149 GiB - ST316081 2A
Partition table type: Intel

Analyse Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63
Geometry from i386 MBR: head=255 sector=63
NTFS at 0/1/1
NTFS at 16573/1/1
get_geometry_from_list_part_aux head=255 nbr=6
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=6
Current partition structure:
1 * HPFS - NTFS 0 1 1 16572 254 63 266245182
2 E extended LBA 16573 0 1 19455 254 63 46315395
5 L HPFS - NTFS 16573 1 1 19455 254 63 46315332

search_part()
Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/1/1
filesystem size 266245182
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16640323
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 16572 254 63 266245182
NTFS, blocksize=4096, 136 GB / 126 GiB
NTFS at 16573/1/1
filesystem size 46315332
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2894708
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16573 1 1 19455 254 63 46315332
NTFS, blocksize=4096, 23 GB / 22 GiB
file_pread(5,2,buffer,312580096(19457/53/53)) lseek err Invalid argument
file_pread(5,1,buffer,312580096(19457/53/53)) lseek err Invalid argument
file_pread(5,15,buffer,312580097(19457/53/54)) lseek err Invalid argument
file_pread(5,3,buffer,312580112(19457/54/6)) lseek err Invalid argument
file_pread(5,3,buffer,312580159(19457/54/53)) lseek err Invalid argument
file_pread(5,8,buffer,312580175(19457/55/6)) lseek err Invalid argument
file_pread(5,11,buffer,312580222(19457/55/53)) lseek err Invalid argument
file_pread(5,2,buffer,312582144(19457/86/22)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 16572 254 63 266245182
NTFS, blocksize=4096, 136 GB / 126 GiB
L HPFS - NTFS 16573 1 1 19455 254 63 46315332
NTFS, blocksize=4096, 23 GB / 22 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * HPFS - NTFS 0 1 1 16572 254 63 266245182
2 E extended LBA 16573 0 1 19455 254 63 46315395
5 L HPFS - NTFS 16573 1 1 19455 254 63 46315332

search_part()
Disk /dev/sdb - 160 GB / 149 GiB - CHS 19457 255 63
NTFS at 0/1/1
filesystem size 266245182
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16640323
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 16572 254 63 266245182
NTFS, blocksize=4096, 136 GB / 126 GiB
NTFS at 16572/254/63
filesystem size 266245182
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 16640323
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 0 1 1 16572 254 63 266245182
NTFS found using backup sector, blocksize=4096, 136 GB / 126 GiB
NTFS at 16573/1/1
filesystem size 46315332
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2894708
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16573 1 1 19455 254 63 46315332
NTFS, blocksize=4096, 23 GB / 22 GiB
NTFS at 19455/254/63
filesystem size 46315332
sectors_per_cluster 8
mft_lcn 786432
mftmirr_lcn 2894708
clusters_per_mft_record -10
clusters_per_index_record 1
HPFS - NTFS 16573 1 1 19455 254 63 46315332
NTFS found using backup sector, blocksize=4096, 23 GB / 22 GiB
file_pread(5,2,buffer,312580096(19457/53/53)) lseek err Invalid argument
file_pread(5,1,buffer,312580096(19457/53/53)) lseek err Invalid argument
file_pread(5,1,buffer,312580095(19457/53/52)) lseek err Invalid argument
get_geometry_from_list_part_aux head=255 nbr=4
get_geometry_from_list_part_aux head=8 nbr=1
get_geometry_from_list_part_aux head=16 nbr=1
get_geometry_from_list_part_aux head=32 nbr=1
get_geometry_from_list_part_aux head=64 nbr=1
get_geometry_from_list_part_aux head=128 nbr=1
get_geometry_from_list_part_aux head=240 nbr=1
get_geometry_from_list_part_aux head=255 nbr=4

Results
* HPFS - NTFS 0 1 1 16572 254 63 266245182
NTFS, blocksize=4096, 136 GB / 126 GiB
L HPFS - NTFS 16573 1 1 19455 254 63 46315332
NTFS, blocksize=4096, 23 GB / 22 GiB
add_ext_part_i386: max
add_ext_part_i386: min

interface_write()
1 * HPFS - NTFS 0 1 1 16572 254 63 266245182
2 E extended LBA 16573 0 1 19455 254 63 46315395
5 L HPFS - NTFS 16573 1 1 19455 254 63 46315332
simulate write!

write_mbr_i386: starting...
write_all_log_i386: starting...
write_all_log_i386: CHS: 16573/0/1,lba=266245245

TestDisk exited normally.

varmint
Posts: 5
Joined: 01 Nov 2012, 23:04

Re: I think MBR is messed up. Won't boot, access denied

#2 Post by varmint »

Admin,

Might as well delete this post of mine, no one is responding to my request for assistance. If I saw a place or how to delete it I would do it.

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: I think MBR is messed up. Won't boot, access denied

#3 Post by Fiona »

Sry for your inconvenience.
This forum doesn't delete anything, except spam.
You can close your topic using the right button (the red and green one) on the upper area.
If you'd like to still have some assistance, please let me know.
As far as I've seen, your partion table looks intact.
Might be possible that your boot loader from your MBR is messed up?
Did you try to repair it?
It's depend on your OS.
Win XP might be fixmbr, fixboot.
If you use Vista WIN7/8 you can use your OS-DVD to repair startup or have a try using console commands like bootrec /fixmbr
In case please let me know.
Also did you use TestDisk to list your files?
Did you see them.
If you've seen an error message, it might be possible that your file system is faulty.

Fiona

varmint
Posts: 5
Joined: 01 Nov 2012, 23:04

Re: I think MBR is messed up. Won't boot, access denied

#4 Post by varmint »

testdisk does see the files for both parttions and I was able to back them up to a usb drive and view them.

this is a XP system. I did try fixboot fix mbr but the drive still does not boot and when I look at the dirve like in a USB docking station. I can see the two partitions but I get access denied when I try look at the first partition.

I should also note that the Kaskrey 10 recovery disk program did find several trojans and did fix them. i am wondering if that was not the original problem and that damaged the disk or some boot up files. An I just don't really understand the mechanics of how the hd works to know what to do. I guess you'd say I have just enough info to mess it up. So I am looking for direction to see if I can get it back without reinstalling everything.

It seems like everything is there it just not want to boot. After the splash screen I get the cntl alt del message just as you would on an unformatted drive.

I looked at some youtubes on testdisk and read through some things here on forms. It looks like your testdisk program makes fixing a dive not a big deal at all. Like I said though I'm not confident in the steps and in what order to do that.

thanks for your help.

dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: I think MBR is messed up. Won't boot, access denied

#5 Post by dragonfly41 »

I suggest trying this boot-repair disk .. burn to CD

https://help.ubuntu.com/community/Boot-Repair

and make use of the pastebin option

varmint
Posts: 5
Joined: 01 Nov 2012, 23:04

Re: I think MBR is messed up. Won't boot, access denied

#6 Post by varmint »

ok I'll get on it now.

On a side note, upon further inspection some files were not recovered from the c drive. It seems hit or miss, some folders in c:windows\program files are there some are not. For instance some that seem to be missing are itunes and wondershare for the smartphones and some of the game maps for armaII, I'm sure that there are others missing as well. So I sure hope this or something else ultimately works.

thank you

varmint
Posts: 5
Joined: 01 Nov 2012, 23:04

Re: I think MBR is messed up. Won't boot, access denied

#7 Post by varmint »

Well I just don't get it with this boot repair program. I have downloaded it and burned it to a cd both with and without making the cd bootable (using joliet ??) and it will not run either way. So I don't get it ???????

I did this on both a windows 7 and XP system . so whatever.....

I'll keep trying.

dragonfly41
Posts: 67
Joined: 14 Sep 2012, 20:51

Re: I think MBR is messed up. Won't boot, access denied

#8 Post by dragonfly41 »

o.k. let's try to recap ..

You have Windows XP SP2 in the failed disk drive (with messed up MBR and will not reboot)?

You have ..
/dev/sda 120 GB as your internal drive (running Windows XP or Vista)
/dev/sdb 160 GB as your external drive (under repair)

The boot repair disc suggested is meant to run as a Live bootable CD on Ubuntu (linux).

If you are having problems then try only Windows GUI tools.

http://partition-recovery-software.blog ... n-due.html

http://www.easeus.com/data-recovery-ebo ... covery.htm

Here is another free tool you can try on Windows ..

http://www.easeus.com/partition-recovery/

Remember that you can sometimes try commercial recovery (usually windows) software in free trial mode to get a better handle on your problem .. then rather than purchasing the software you can return to free testdisk with a better understanding of what is needed.

Locked